# How to check nginx OCSP verification

**URL:** <https://www.ruby-forum.com/t/how-to-check-nginx-ocsp-verification/244177>\
**Category:** NGINX\
**Created:** [March 1, 2016, 2:54pm UTC](https://www.ruby-forum.com/t/how-to-check-nginx-ocsp-verification/244177 "2016-03-01T14:54:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [March 1, 2016, 2:54pm UTC](https://www.ruby-forum.com/t/how-to-check-nginx-ocsp-verification/244177/1 "2016-03-01T14:54:28Z")

</div>

Hello,

I want to configure a server with:  
ssl\_stapling on;  
ssl\_stapling\_verify on;

What should happen if the ssl\_trusted\_certificate is  
(not|mis)configured?  
How to check nginx is properly configured and server-side OCSP response  
verification works?

## Thanks,

_B. R._

---

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [March 1, 2016, 3:13pm UTC](https://www.ruby-forum.com/t/how-to-check-nginx-ocsp-verification/244177/2 "2016-03-01T15:13:10Z")

</div>

* * *

nginx mailing list  
removed\_email\_address@domain.invalid  
[http://mailman.nginx.org/mailman/listinfo/nginx](http://mailman.nginx.org/mailman/listinfo/nginx)

---

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [March 1, 2016, 5:33pm UTC](https://www.ruby-forum.com/t/how-to-check-nginx-ocsp-verification/244177/3 "2016-03-01T17:33:22Z")

</div>

Hello,

You can check with this command found on this website:

> **[Testing OCSP Stapling](https://unmitigatedrisk.com/2012/06/100/)**
>
> So you have configured OCSP stapling and you want know if it’s actually working, it’s easy enough to check using the openssl sclient command:

openssl s\_client -connect login.live.com:443 -tls1 -tlsextdebug  
-status

# If everything goes well, you should find something like: "OCSP response:

OCSP Response Data:  
OCSP Response Status: successful (0x0)  
Response Type: Basic OCSP Response  
…"

If there’s no stapling, you’ll get:  
“OCSP response: no response sent”.

Please note: when you restart nginx, you won’t get an OCSP answer  
immediatly. You’ll have to visit the URL and wait a few seconds before  
having the stapling working for the next request. IIRC, this behavior is  
because OCSP servers may be slow to answer.

Best Regards

Posted at Nginx Forum:  
[https://forum.nginx.org/read.php?2,264967,264977#msg-264977](https://forum.nginx.org/read.php?2,264967,264977#msg-264977)

---

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [March 1, 2016, 9:01pm UTC](https://www.ruby-forum.com/t/how-to-check-nginx-ocsp-verification/244177/4 "2016-03-01T21:01:55Z")

</div>

B.R.:

> I want to have details about the status nginx’ validation of the initial  
> OCSP query it did to the OCSP responder of the CA, especially when it goes  
> wrong.

we do not let nginx fetch the ocsp data itself but use  
ssl\_stapling\_file.  
a cronjob call openssl and VERIFY the ocsp resonse.

```
 OCSP_RESPONSE='/path/to/ocsp_response_file' # ssl_stapling_file

```

in nginx.conf

```
 # all intermediate and root certificates exept the certificate 

```

itself  
CA\_CHAIN=‘/tmp/ca\_chain.pem’  
cat intermediate.pem root.pem \> $CA\_CHAIN

```
 DIRECT_ISSUER='root.pem' # or intermediate.pem, exact one 

```

certificate  
CERT=‘cert.pem’ # for this certificate we need the OCSP  
response…

```
 OCSP_URI=`openssl x509 -noout -text -in ${CERT} | grep 'OCSP -

```

URI:’ | cut -d: -f2,3`

```
 openssl ocsp -no_nonce \
         -respout ${OCSP_RESPONSE}.tmp \
         -CAfile ${CA_CHAIN} \
         -issuer ${DIRECT_ISSUER} \
         -cert ${CERT} \
         -url ${OCSP_URI}
         ${EXTRA_ARGS}

 if [$? -eq 0]; then
   # handle error
 fi

 # success
 mv ${OCSP_RESPONSE}.tmp ${OCSP_RESPONSE}
 killall -HUP nginx

```

EXTRA\_ARGS handle some special tweaks

- Startcom: [https://forum.startcom.org/viewtopic.php?f=15&t=2661](https://forum.startcom.org/viewtopic.php?f=15&t=2661)  
EXTRA\_ARGS=‘-header HOST [ocsp.startssl.com](http://ocsp.startssl.com)’

- Let’s Entrypt:  
[Unable to verify OCSP response - #3 by jsha - Server - Let's Encrypt Community Support](https://community.letsencrypt.org/t/unable-to-verify-ocsp-response/7264/3)  
EXTRA\_ARGS=‘-header HOST [ocsp.int-x1.letsencrypt.org](http://ocsp.int-x1.letsencrypt.org) -verify\_other  
${DIRECT\_ISSUER}’

you may want to adjust to your needs.

Andreas

---

<div class="post-metadata">

**Author:** ![B.R](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/3be4f8/32.png) [@B.R](https://www.ruby-forum.com/u/B.R)\
**Post date:** [March 1, 2016, 6:14pm UTC](https://www.ruby-forum.com/t/how-to-check-nginx-ocsp-verification/244177/5 "2016-03-01T18:14:15Z")

</div>

I do not want to validate OCSP responses client-side, which are OK.  
I want to have details about the status nginx’ validation of the initial  
OCSP query it did to the OCSP responder of the CA, especially when it  
goes  
wrong.

I noted that even though ssl\_trusted\_certificate is not set or set with  
a  
wrong (set of) certificate(s), a cached OCSP response will served by  
nginx  
to the client after an initial request has been made to a domain hosted  
by  
it and served through TLS.  
I want to know the consequences of having such a directive badly  
configured  
:

- error.log message? Found nothing
- modified OCSP response? Nope
- …  
What am I supposed to notice and where/when?​

* * *

_B. R._